Add OCSP and CRL URIs to certificates

Modify the default IPA CA certificate profile to include CRL and
OCSP extensions which will add URIs to IPA CRL&OCSP to published
certificates.

Both CRL and OCSP extensions have 2 URIs, one pointing directly to
the IPA CA which published the certificate and one to a new CNAME
ipa-ca.$DOMAIN which was introduced as a general CNAME pointing
to all IPA replicas which have CA configured.

The new CNAME is added either during new IPA server/replica/CA
installation or during upgrade.

https://fedorahosted.org/freeipa/ticket/3074
https://fedorahosted.org/freeipa/ticket/1431

1 files changed, 8 insertions, 6 deletions

diff --git a/install/tools/ipa-server-install b/install/tools/ipa-server-install
index 92e9dcf2f..306d1e07b 100755
--- a/install/tools/ipa-server-install
+++ b/install/tools/ipa-server-install
@@ -965,8 +965,8 @@ def main():
         ca = cainstance.CAInstance(realm_name, certs.NSS_DIR,
             dogtag_constants=dogtag.install_constants)
         if external == 0:
-            ca.configure_instance(host_name, dm_password, dm_password,
-                                  subject_base=options.subject)
+            ca.configure_instance(host_name, domain_name, dm_password,
+                                  dm_password, subject_base=options.subject)
         elif external == 1:
             # stage 1 of external CA installation
             options.realm_name = realm_name
@@ -979,12 +979,13 @@ def main():
             options.forwarders = dns_forwarders
             options.reverse_zone = reverse_zone
             write_cache(vars(options))
-            ca.configure_instance(host_name, dm_password, dm_password,
-                                  csr_file="/root/ipa.csr",
+            ca.configure_instance(host_name, domain_name, dm_password,
+                                  dm_password, csr_file="/root/ipa.csr",
                                   subject_base=options.subject)
         else:
             # stage 2 of external CA installation
-            ca.configure_instance(host_name, dm_password, dm_password,
+            ca.configure_instance(host_name, domain_name, dm_password,
+                                  dm_password,
                                   cert_file=options.external_cert_file,
                                   cert_chain_file=options.external_ca_file,
                                   subject_base=options.subject)
@@ -1079,7 +1080,8 @@ def main():
                options.conf_ntp, reverse_zone, zonemgr=options.zonemgr,
                zone_refresh=options.zone_refresh,
                persistent_search=options.persistent_search,
-               serial_autoincrement=options.serial_autoincrement)
+               serial_autoincrement=options.serial_autoincrement,
+               ca_configured=not options.selfsign)
     if options.setup_dns:
         api.Backend.ldap2.connect(bind_dn=DN(('cn', 'Directory Manager')), bind_pw=dm_password)